TW201626235A - An integrated circuit and method for detection of malicious code in a first level instruction cache - Google Patents

Abstract

An integrated circuit may comprise a processor, a first level instruction cache having a first storage capacity, and a second level cache having a second storage capacity that is larger than the first storage capacity. The first level instruction cache is configured to store a subset of instructions stored in the second level cache. The second level cache is configured to store a subset of data and instructions stored in an external memory. The processor executes an inner loop of a detection routine and monitors an execution time of the inner loop to detect malicious code in the first level instruction cache. A total number of detection routine instructions is larger than the first storage capacity. The inner loop requires fetching of detection routine instructions from the second level cache, and an execution number of instructions executed during execution of the inner loop is smaller than the first storage capacity.

Description

Integrated circuit and method for detecting malicious code in first-order instruction cache Cross-reference to related applications

The present application claims priority to and the benefit of U.S. Patent Application Serial No. 14/493,306, filed on Sep.

The present invention is generally directed to detecting malicious code associated with a no-fetch attack.

Many computing environments include instructions to extract one or more instructions directly from RAM. These instructions are not stored in the second order (L2) cache, but instead are copied directly into the smaller and faster first order (L1) instruction cache. Usually, bypass L2 cache for good faith operation. However, the ability to execute code without accessing the L2 cache allows the enemy to replace the harmless code using the L2 cache with a malicious/damage code that does not use L2 cache and this replacement is not found. For example, if the entire malicious code is adapted to the L1 cache, the malicious code can hide its presence without being detected by the scanning/detecting software.

Therefore, the ability to detect malicious code hidden in the first-order instruction cache is required.

An aspect of the present invention can reside in an integrated circuit, comprising: a processor; a first order instruction cache having a first storage capacity; and a second order cache, There is a second storage capacity greater than one of the first storage capacities. The first order instruction cache is coupled between the processor and the second stage cache and configured to store a subset of the instructions stored in the second stage cache. The second stage cache is coupled between the first order instruction cache and an external memory, and configured to store a subset of the data and instructions stored in the external memory. The processor is configured to perform an internal loop of one of the detection routines and monitor an execution time of the internal loop to detect a malicious code in the first order instruction cache. The total number of detected routine commands is greater than the first storage capacity. During execution, the internal loop needs to extract the detection routine instruction from the second-order cache, and the number of executions of the instructions executed during execution of the internal loop is less than the first storage capacity.

In a more detailed aspect of the invention, the number of executions can be significantly less than the first storage capacity. The detection routine instructions may comprise a series of similar functions, and at least two of the series of similar functions may be different. During execution, the internal loop of the detection routine may include a selection of at least one detection routine command based on at least one selection input that is unknown prior to the execution of the detection routine.

Another aspect of the present invention can reside in a method, including: performing, by a processor, an internal loop of a detection routine, wherein the total number of detected routine instructions is greater than a first order instruction cache a first storage capacity; and a second-order cache extraction detection routine command having a second storage capacity when the internal loop is being executed, the second-order cache being used to store an external memory a subset of the data and instructions stored in the execution, wherein the number of executions of the instructions executed during execution of the internal loop is less than the first storage capacity; and the execution time of the internal loop is monitored by the processor to detect The malicious code in the first-order instruction cache is measured.

Another aspect of the present invention can reside in an integrated circuit, comprising: means for performing an internal loop of one of the detection routines, wherein the total number of detection routine instructions is greater than a first order instruction Taking a first storage capacity; for extracting a detection routine command from a second-order cache having a second storage capacity while the internal loop is being executed, the second order Cache for storing a subset of data and instructions stored in an external memory, wherein the number of executions of instructions executed during execution of the internal loop is less than the first storage capacity; and for monitoring the internal back One of the loop execution times to detect the artifact of the malicious code in the first-order instruction cache.

Another aspect of the present invention can reside in a computer program product, comprising: a computer readable medium, comprising: a code for causing a computer to perform an internal loop of a detection routine, wherein the detection The total number of the normal instructions is greater than the first storage capacity of the first order instruction cache, wherein during the execution period, the internal loop needs to extract the detection routine command from the second order cache having a second storage capacity. The second stage cache is configured to store a subset of data and instructions stored in an external memory, and wherein the number of executions of instructions executed during execution of the internal loop is less than the first storage capacity; The computer is configured to monitor an execution time of the internal loop to detect a code of the malicious code in the first-order instruction cache.

100‧‧‧Wireless communication system

102‧‧‧Wireless Remote Station (RS)

104‧‧‧Base station

106‧‧‧Base Station Controller (BSC)

108‧‧‧core network

110‧‧‧Internet

112‧‧‧Public Exchange Telephone Network (PSTN)

210‧‧‧ integrated circuit

220‧‧‧Processors/components

230‧‧‧first order instruction cache

240‧‧‧second-order cache

250‧‧‧External memory/computer readable media

260‧‧‧L1 data cache

300‧‧‧Detective routine

310‧‧‧Internal loop

350‧‧6 bytes

360‧‧6 bytes

370‧‧‧ Jump

400‧‧‧Method for detecting malicious code in the first-order instruction cache

500‧‧‧ computer

510‧‧‧Processor/component

520‧‧‧Storage media/computer readable media

530‧‧‧ display

540‧‧‧Input device

550‧‧‧Wireless connection

1 is a block diagram of an example of a wireless communication system.

2 is a block diagram of an integrated circuit for implementing a technique for detecting a malicious code in a first order instruction cache in accordance with an aspect of the present invention.

3 is a flow chart of a detection routine in accordance with aspects of the present invention.

4 is a flow chart of a method for detecting a malicious code in a first order instruction cache in accordance with aspects of the present invention.

Figure 5 is a block diagram of a computer including a processor and a memory.

The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous.

Referring to FIG. 2 and FIG. 3, an aspect of the present invention may reside in the integrated circuit 210, including: a processor 220, a first order instruction cache 230 having a first storage capacity, and having a greater than A second order cache 240 of the second storage capacity of the first storage capacity. The first order instruction cache is coupled between the processor and the second stage cache and configured to store a subset of the instructions stored in the second order cache. The second stage cache is coupled between the first order instruction cache and the external memory 250 and configured to store a subset of the data and instructions stored in the external memory. The processor is configured to execute the internal loop 310 of the detection routine 300 and monitor the execution time of the internal loop to detect the malicious code in the first order instruction cache. The total number of detected routine commands is greater than the first storage capacity. During execution, the internal loop needs to extract the detection routine instruction from the second-order cache, and the number of executions of the instructions executed during the execution of the internal loop is less than the first storage capacity.

In a more detailed aspect of the invention, the number of executions can be significantly less than the first storage capacity. The detection routine instruction can contain a series of similar functions, and at least two of the similar functions of the series can be different. During execution, the internal loop 310 of the detection routine 300 can include a selection of at least one detection routine command based on at least one selection input that is unknown prior to execution of the detection routine. The first order instruction cache may contain 4 kilobytes and the number of executions may include 16.

With further reference to FIGS. 1 and 5, the remote station 102 can include a processor 510 (eg, processor 220 in integrated circuit 210), a storage medium 520 (such as memory 250 and/or a disk drive). Computer 500, display 530, and input device 540, such as a keypad, and wireless connection 550 (such as a Wi-Fi connection and/or a cellular connection).

With further reference to FIG. 4, another aspect of the present invention can reside in method 400, comprising: performing, by processor 220, internal loop 310 of detection routine 300 (step 410). The total number of detected routine instructions is greater than the first storage capacity of the first order instruction cache 230. When the internal loop is being executed, the detection routine command is extracted from the second-order cache 240 having the second storage capacity, and the second-order cache is used to store the data and instructions stored in the external memory 250. set. The number of executions of instructions executed during execution of the internal loop is less than the first storage capacity. The method further includes monitoring, by the processor, an execution time of the internal loop to detect the The malicious code in the first order instruction cache (step 420).

Another aspect of the present invention can reside in integrated circuit 210, including: means (eg, 220, 510) for performing internal loop 310 of detection routine 300, wherein the total number of routine instructions is detected a first storage capacity greater than the first-order instruction cache 230; configured to extract a component that detects the routine instruction from the second-order cache 240 having the second storage capacity while the internal loop is being executed (eg, 220, 510) The second-order cache is used to store a subset of the data and instructions stored in the external memory 250, and wherein the number of executions of instructions executed during execution of the internal loop is less than the first storage capacity; A component that monitors the execution time of the internal loop to detect malicious code in the first-order instruction cache (eg, 220, 510).

Another aspect of the present invention can reside in a computer program product, comprising: a computer readable medium (e.g., 250, 520), comprising: a program for causing a computer to execute an internal loop 310 that detects routine 300 The code, wherein the total number of detection routine instructions is greater than the first storage capacity of the first order instruction cache 230, wherein during execution, the internal loop needs to extract the detection routine from the second order cache 240 having the second storage capacity. The second stage cache is configured to store a subset of the data and instructions stored in the external memory 250, and wherein the number of executions of the instructions executed during execution of the internal loop is less than the first storage capacity; The computer is caused to monitor the execution time of the internal loop to detect the code of the malicious code in the first-order instruction cache.

One aspect of the present invention relates to the use of a bona fide/integrity code, i.e., a detection routine 300 that prevents malicious unfavourable fetching from being adapted into the L1 cache 230 and executed quickly (e.g., 1.6 milliseconds). For the purposes of usability and security, fast execution is desirable for software-based authentication (SBA). The good faith code has the following characteristics: 1) The internal loop 310 of the good faith code is large, meaning that it is not suitable for the L1 cache, and therefore, the execution of the internal loop needs to be from the L2 cache 240 or RAM/minor The memory extracts the code; and 2) the number of instructions executed for a rewind of the inner loop is substantially less than the number of instructions adapted to the L1 cache.

This is achieved by using a broad branch with a good faith code, some of which are branches The minute causes the L1 cache miss to occur because all of the code that can be forked out to the inner loop 310 cannot be adapted to the L1 cache 230. As long as the different branches contain sufficiently different code (such as different operations or shifts) without causing delays associated with decompression, the good faith code cannot be compressed or represented in a manner that is adapted to the L1 cache. Therefore, a malicious code attempting to perform the same computing task will take a significant amount of time to perform or be attributed to a cache miss due to decompression and take a long time to execute. This is because the good faith code can be stored in both the L1 cache and the L2 cache. When there is an L1 cache miss, things are loaded from L2 to L1; however, the malicious code wants to avoid using L2, and any L1 is fast. Taking a miss will result in decompression (which takes a long time) or extracting data from DRAM or other slow storage (which also takes a long time.) The combination of this structure with other pipeline/extraction failure structures ensures that the fast-attack attack cannot be Not carried out without being detected.

Examples of good faith codes may include a series of similar (or equivalent) but different functions (mutual exclusion or (XOR), bit rotation, addition and exchange, etc.), which may require 6 kilobytes. The capacity of the L1 instruction cache can be 4 kilobytes, that is, the good faith code can be about 150% of the size of the L1 instruction cache. The bona fide code may only perform, for example, 16 steps, but at each step it unpredictably selects a new function based on conditions 1, 2...N (which is unknown until the execution period) (eg, F1, F2... FN). Therefore, at each step, there is a change in cache miss that cannot be predicted/avoided by malicious unpleasant fetching. For a good faith code, a cache miss will cause a small delay because the code for the new function is accessed (or paged) from the L2 cache. However, a cache miss in the presence of malicious unpleasant fetching will result in access to external memory 250 (eg, RAM or secondary storage (such as a disk drive or the like), which is more expensive. Access for a long time. Therefore, delays due to longer execution times allow the detection of the presence of malicious code.

Each function can contain arithmetic and arithmetic elements, such as XOR 3076 or AND Z. The first-order cache may also include an L1 data cache 260.

The goodwill code of the detection routine 300 may also include a common instruction to load with the execution phase A register of known content (step 320). Optionally, the scratchpad content can include the step of processing the scratchpad content (step 330). The common code may include a jump instruction that branches out to a location or code path based on the contents or state of the scratchpad (step 340). Each code path may contain a sequence of additional 6 bytes (350, 360...), including a jump 370 to the beginning of the common portion. The common portion may include a continuation step to exit the branch of loop 310 (step 380) or return upon completion (step 390). Thus, in this example, there may be 1000 branch paths, each of which is 6 bytes long, resulting in approximately 6 kilobytes for detecting the normal. The common code can contain approximately 10 bytes.

The disclosed technique resists attacks that bypass the L2 cache and is directly applied to the detection of malicious code in action (including active malicious code in action). As an example, a malicious code residing in memory 250 and L1 instruction cache 230 but not resident in L2 cache 240 may calculate a sum check code for a harmless or integrity code residing in L2 cache and return to The sum check code avoids detection. The malicious code cannot be hidden by forcing the malicious code to reside in the L2 cache (from the sum check code detection) or the memory causing the significant delay (if it is implemented) (self-execution time detection).

The foregoing description also applies to a cache hierarchy having more than two levels, or more generally, to a memory hierarchy having more than three levels, and wherein the good faith code is configured to use a subset of the available levels, and The goal is to detect if the malicious code uses another set of available classes.

Referring to FIG. 1, a wireless remote station (RS) 102 can communicate with one or more base stations (BS) 104 of a wireless communication system 100. The RS can be a mobile station. The wireless communication system 100 can further include one or more base station controllers (BSCs) 106, and a core network 108. The core network can be connected to the Internet 110 and the Public Switched Telephone Network (PSTN) 112 via a suitable backhaul. A typical wireless mobile station can include a handheld phone or a laptop. The wireless communication system 100 can use any of a variety of multiple access technologies, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), and multiple domain multiple access. (SDMA), polarization division multiple access (PDMA) or other modulation techniques known in the art.

Those skilled in the art will appreciate that information and signals may be represented using any of a variety of different techniques and techniques. For example, the materials, instructions, commands, information, signals, bits, symbols, and chips referred to in the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, light fields or light particles, or any combination thereof.

Those skilled in the art will further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein can be implemented as an electronic hardware, a computer software, or a combination of both. . To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of functionality. Implementing this functionality as hardware or software depends on the particular application and design constraints imposed on the overall system. Those skilled in the art can implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as a departure from the scope of the invention.

Can be used by general purpose processors, digital signal processors (DSPs), special application integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic, discrete The hardware components or any combination thereof designed to perform any of the functions described herein implement or perform the various illustrative logic blocks, modules, and circuits described in connection with the embodiments disclosed herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in the hardware, in a software module executed by a processor, or in a combination of the two. The software module can reside in RAM memory, flash memory, ROM memory, EPROM memory Body, EEPROM memory, scratchpad, hard drive, removable disk, CD-ROM, or any other form of storage medium known in the art. The exemplary storage medium is coupled to the processor such that the processor can read information from the storage medium and write the information to the storage medium. In the alternative, the storage medium can be integrated into the processor. The processor and the storage medium can reside in an ASIC. The ASIC can reside in the user terminal. In the alternative, the processor and the storage medium may reside as discrete components in the user terminal.

In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented as a computer program product, the functions may be stored as one or more instructions or code on a computer readable medium or transmitted through a computer readable medium. Computer-readable media includes both non-transitory computer storage media and communication media including any medium that facilitates transfer of the computer program from one location to another. The storage medium can be any available media that can be accessed by a computer. By way of example and not limitation, such computer-readable media may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, or may be used to carry or store instructions or Any other medium in the form of a data structure that is to be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if you use a coaxial cable, fiber optic cable, twisted pair cable, digital subscriber line (DSL), or wireless technology such as infrared, radio, and microwave to transmit software from a website, server, or other remote source, then coaxial Cables, fiber optic cables, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of the media. As used herein, magnetic disks and optical disks include compact discs (CDs), laser compact discs, optical compact discs, digital audio and video discs (DVDs), floppy discs, and Blu-ray discs, where the discs are typically magnetically regenerated and the discs are borrowed. The material is optically reproduced by laser. Combinations of the above should also be included in the context of computer readable media.

The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to the embodiments of the invention will be readily apparent to those skilled in the <RTIgt; The general principles of the application apply to other embodiments. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but the broadest scope of the principles and novel features disclosed herein.

210‧‧‧ integrated circuit

220‧‧‧Processors/components

230‧‧‧first order instruction cache

240‧‧‧second-order cache

250‧‧‧External memory/computer readable media

260‧‧‧L1 data cache

Claims (19)

An integrated circuit comprising: a processor; a first order instruction cache having a first storage capacity; and a second order cache having a second storage capacity greater than the first storage capacity The first-order instruction cache is coupled between the processor and the second-order cache, and the first-order instruction cache is configured to store a subset of the instructions stored in the second-order cache The second-order cache is coupled between the first-order instruction cache and an external memory, and the second-order cache is configured to store a subset of the data and instructions stored in the external memory. And the processor is configured to perform an internal loop of one of the detection routines, and monitor an execution time of the internal loop to detect the malicious code in the first-order instruction cache, wherein the detection is often The total number of one of the instructions is greater than the first storage capacity, wherein the internal loop needs to extract the detection routine instruction from the second-order cache during execution, and wherein one of the instructions executed during execution of the internal loop The number of executions is less than the first storage capacity. The integrated circuit of claim 1, wherein the number of executions is significantly smaller than the first storage capacity. The integrated circuit of claim 1, wherein the detection routines comprise a series of similar functions, and wherein at least two of the series of similar functions are different. The integrated circuit of claim 1, wherein during execution, the internal loop of the detection routine includes at least one selection based on an unknown before the execution of the detection routine The input selects one of at least one detection routine instruction. A method includes: performing, by a processor, an internal loop of one of the detection routines, wherein the total number of the detected routine instructions is greater than a first storage capacity of the first order instruction cache; and When the internal loop is being executed, the second-order cache extracts a detection routine command having a second storage capacity, and the second-order cache is used to store a piece of data and instructions stored in an external memory. The set, wherein the number of executions of one of the instructions executed during execution of the internal loop is less than the first storage capacity; and the processor monitors one of the internal loop execution times to detect the first order instruction cache The malicious code in the middle. The method of claim 5, wherein the number of executions is significantly less than the first storage capacity. The method of claim 5, wherein the detected routine instructions comprise a series of similar functions, and wherein at least two functions of the series of similar functions are different. The method of claim 5, wherein the internal loop of the detection routine includes, when executed, one of at least one detection routine command based on at least one selection input unknown prior to the execution of the detection routine select. The method of claim 5, wherein the second storage capacity is greater than the first storage capacity and the first-order instruction cache stores a subset of the instructions stored in the second-order cache, wherein the first-order instruction The cache is coupled between the processor and the second-order cache, and the second-stage cache is coupled between the first-order instruction cache and the external memory. An integrated circuit, comprising: a component for performing an internal loop of a detection routine, wherein a total number of detection routines is greater than a first storage capacity of a first order instruction cache; Extracting a component detecting a normal command from a second-order cache having a second storage capacity while the internal loop is being executed, the second-order cache being used to store an outer a subset of the data and instructions stored in the memory, wherein the number of executions of one of the instructions executed during execution of the internal loop is less than the first storage capacity; and for monitoring one of the internal loop execution times The component for detecting the malicious code in the first-order instruction cache. The integrated circuit of claim 10, wherein the number of executions is significantly less than the first storage capacity. The integrated circuit of claim 10, wherein the detection routines comprise a series of similar functions, and wherein at least two of the series of similar functions are different. The integrated circuit of claim 10, wherein the internal loop of the detection routine during execution includes at least one selection input unknown to the at least one detection routine command prior to the execution of the detection routine A choice. The integrated circuit of claim 10, wherein the second storage capacity is greater than the first storage capacity, and the first-order instruction cache stores a subset of the instructions stored in the second-order cache. A computer program product comprising: a computer readable medium, comprising: a code for causing a computer to execute an internal loop of a detection routine, wherein the total number of detection routines is greater than a first order The instruction cache is a first storage capacity, wherein during the execution, the internal loop needs to extract a detection routine command from a second-order cache having a second storage capacity, and the second-order cache is used to store one a subset of the data and instructions stored in the external memory, and wherein the number of executions of one of the instructions executed during execution of the internal loop is less than the first storage capacity; and for causing the computer to monitor the internal loop One execution time is to detect the code of the malicious code in the first-order instruction cache. The computer program product of claim 15, wherein the number of executions is significantly less than the first Storage capacity. The computer program product of claim 15, wherein the number of executions is less than the first storage capacity. The computer program product of claim 15, wherein the internal loop of the detection routine includes, when executed, at least one selection input based on the at least one selection input unknown before the execution of the detection routine One choice. The computer program product of claim 15, wherein the second storage capacity is greater than the first storage capacity, and the first-order instruction cache stores a subset of the instructions stored in the second-order cache, wherein the first The first order instruction cache is coupled between the first stage cache and the second stage cache, and the second stage cache is coupled between the first order instruction cache and the external memory.